CRM/Utils/REST.php

   1 <?php
   2 /*
   3    +--------------------------------------------------------------------+
   4    | CiviCRM version 5                                                  |
   5    +--------------------------------------------------------------------+
   6    | Copyright CiviCRM LLC (c) 2004-2019                                |
   7    +--------------------------------------------------------------------+
   8    | This file is a part of CiviCRM.                                    |
   9    |                                                                    |
  10    | CiviCRM is free software; you can copy, modify, and distribute it  |
  11    | under the terms of the GNU Affero General Public License           |
  12    | Version 3, 19 November 2007 and the CiviCRM Licensing Exception.   |
  13    |                                                                    |
  14    | CiviCRM is distributed in the hope that it will be useful, but     |
  15    | WITHOUT ANY WARRANTY; without even the implied warranty of         |
  16    | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.               |
  17    | See the GNU Affero General Public License for more details.        |
  18    |                                                                    |
  19    | You should have received a copy of the GNU Affero General Public   |
  20    | License and the CiviCRM Licensing Exception along                  |
  21    | with this program; if not, contact CiviCRM LLC                     |
  22    | at info[AT]civicrm[DOT]org. If you have questions about the        |
  23    | GNU Affero General Public License or the licensing of CiviCRM,     |
  24    | see the CiviCRM license FAQ at http://civicrm.org/licensing        |
  25    +--------------------------------------------------------------------+
  26  */
  27
  28 /**
  29  * This class handles all REST client requests.
  30  *
  31  * @package CRM
  32  * @copyright CiviCRM LLC (c) 2004-2019
  33  */
  34 class CRM_Utils_REST {
  35
  36   /**
  37    * Number of seconds we should let a REST process idle
  38    * @var int
  39    */
  40   public static $rest_timeout = 0;
  41
  42   /**
  43    * Cache the actual UF Class
  44    * @var string
  45    */
  46   public $ufClass;
  47
  48   /**
  49    * Class constructor.  This caches the real user framework class locally,
  50    * so we can use it for authentication and validation.
  51    *
  52    * @internal param string $uf The userframework class
  53    */
  54   public function __construct() {
  55     // any external program which call Rest Server is responsible for
  56     // creating and attaching the session
  57     $args = func_get_args();
  58     $this->ufClass = array_shift($args);
  59   }
  60
  61   /**
  62    * Simple ping function to test for liveness.
  63    *
  64    * @param string $var
  65    *   The string to be echoed.
  66    *
  67    * @return string
  68    */
  69   public static function ping($var = NULL) {
  70     $session = CRM_Core_Session::singleton();
  71     $key = $session->get('key');
  72     // $session->set( 'key', $var );
  73     return self::simple(['message' => "PONG: $key"]);
  74   }
  75
  76   /**
  77    * Generates values needed for error messages.
  78    * @param string $message
  79    *
  80    * @return array
  81    */
  82   public static function error($message = 'Unknown Error') {
  83     $values = [
  84       'error_message' => $message,
  85       'is_error' => 1,
  86     ];
  87     return $values;
  88   }
  89
  90   /**
  91    * Generates values needed for non-error responses.
  92    * @param array $params
  93    *
  94    * @return array
  95    */
  96   public static function simple($params) {
  97     $values = ['is_error' => 0];
  98     $values += $params;
  99     return $values;
 100   }
 101
 102   /**
 103    * @return string
 104    */
 105   public function run() {
 106     $result = self::handle();
 107     return self::output($result);
 108   }
 109
 110   /**
 111    * @return string
 112    */
 113   public function bootAndRun() {
 114     $response = $this->loadCMSBootstrap();
 115     if (is_array($response)) {
 116       return self::output($response);
 117     }
 118     return $this->run();
 119   }
 120
 121   /**
 122    * @param $result
 123    *
 124    * @return string
 125    */
 126   public static function output(&$result) {
 127     $requestParams = CRM_Utils_Request::exportValues();
 128
 129     $hier = FALSE;
 130     if (is_scalar($result)) {
 131       if (!$result) {
 132         $result = 0;
 133       }
 134       $result = self::simple(['result' => $result]);
 135     }
 136     elseif (is_array($result)) {
 137       if (CRM_Utils_Array::isHierarchical($result)) {
 138         $hier = TRUE;
 139       }
 140       elseif (!array_key_exists('is_error', $result)) {
 141         $result['is_error'] = 0;
 142       }
 143     }
 144     else {
 145       $result = self::error('Could not interpret return values from function.');
 146     }
 147
 148     if (!empty($requestParams['json'])) {
 149       if (!empty($requestParams['prettyprint'])) {
 150         // Don't set content-type header for api explorer output
 151         return json_encode(array_merge($result), JSON_PRETTY_PRINT + JSON_UNESCAPED_SLASHES + JSON_UNESCAPED_UNICODE);
 152         return self::jsonFormated(array_merge($result));
 153       }
 154       CRM_Utils_System::setHttpHeader('Content-Type', 'application/json');
 155       return json_encode(array_merge($result));
 156     }
 157
 158     if (isset($result['count'])) {
 159       $count = ' count="' . $result['count'] . '" ';
 160     }
 161     else {
 162       $count = "";
 163     }
 164     $xml = "<?xml version=\"1.0\"?>
 165       <ResultSet xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" $count>
 166       ";
 167     // check if this is a single element result (contact_get etc)
 168     // or multi element
 169     if ($hier) {
 170       foreach ($result['values'] as $k => $v) {
 171         if (is_array($v)) {
 172           $xml .= "<Result>\n" . CRM_Utils_Array::xml($v) . "</Result>\n";
 173         }
 174         elseif (!is_object($v)) {
 175           $xml .= "<Result>\n<id>{$k}</id><value>{$v}</value></Result>\n";
 176         }
 177       }
 178     }
 179     else {
 180       $xml .= "<Result>\n" . CRM_Utils_Array::xml($result) . "</Result>\n";
 181     }
 182
 183     $xml .= "</ResultSet>\n";
 184     return $xml;
 185   }
 186
 187   /**
 188    * @return array|int
 189    */
 190   public static function handle() {
 191     $requestParams = CRM_Utils_Request::exportValues();
 192
 193     // Get the function name being called from the q parameter in the query string
 194     $q = CRM_Utils_Array::value('q', $requestParams);
 195     // or for the rest interface, from fnName
 196     $r = CRM_Utils_Array::value('fnName', $requestParams);
 197     if (!empty($r)) {
 198       $q = $r;
 199     }
 200     $entity = CRM_Utils_Array::value('entity', $requestParams);
 201     if (empty($entity) && !empty($q)) {
 202       $args = explode('/', $q);
 203       // If the function isn't in the civicrm namespace, reject the request.
 204       if ($args[0] != 'civicrm') {
 205         return self::error('Unknown function invocation.');
 206       }
 207
 208       // If the query string is malformed, reject the request.
 209       // Does this mean it will reject it
 210       if ((count($args) != 3) && ($args[1] != 'ping')) {
 211         return self::error('Unknown function invocation.');
 212       }
 213       $store = NULL;
 214
 215       if ($args[1] == 'ping') {
 216         return self::ping();
 217       }
 218     }
 219     else {
 220       // or the api format (entity+action)
 221       $args = [];
 222       $args[0] = 'civicrm';
 223       $args[1] = CRM_Utils_Array::value('entity', $requestParams);
 224       $args[2] = CRM_Utils_Array::value('action', $requestParams);
 225     }
 226
 227     // Everyone should be required to provide the server key, so the whole
 228     // interface can be disabled in more change to the configuration file.
 229     // first check for civicrm site key
 230     if (!CRM_Utils_System::authenticateKey(FALSE)) {
 231       $docLink = CRM_Utils_System::docURL2("Managing Scheduled Jobs", TRUE, NULL, NULL, NULL, "wiki");
 232       $key = CRM_Utils_Array::value('key', $requestParams);
 233       if (empty($key)) {
 234         return self::error("FATAL: mandatory param 'key' missing. More info at: " . $docLink);
 235       }
 236       return self::error("FATAL: 'key' is incorrect. More info at: " . $docLink);
 237     }
 238
 239     // At this point we know we are not calling ping which does not require authentication.
 240     // Therefore we now need a valid server key and API key.
 241     // Check and see if a valid secret API key is provided.
 242     $api_key = CRM_Utils_Request::retrieve('api_key', 'String', $store, FALSE, NULL, 'REQUEST');
 243     if (!$api_key || strtolower($api_key) == 'null') {
 244       return self::error("FATAL: mandatory param 'api_key' (user key) missing");
 245     }
 246     $valid_user = CRM_Core_DAO::getFieldValue('CRM_Contact_DAO_Contact', $api_key, 'id', 'api_key');
 247
 248     // If we didn't find a valid user, die
 249     if (empty($valid_user)) {
 250       return self::error("User API key invalid");
 251     }
 252
 253     return self::process($args, self::buildParamList());
 254   }
 255
 256   /**
 257    * @param $args
 258    * @param array $params
 259    *
 260    * @return array|int
 261    */
 262   public static function process(&$args, $params) {
 263     $params['check_permissions'] = TRUE;
 264     $fnName = $apiFile = NULL;
 265     // clean up all function / class names. they should be alphanumeric and _ only
 266     for ($i = 1; $i <= 3; $i++) {
 267       if (!empty($args[$i])) {
 268         $args[$i] = CRM_Utils_String::munge($args[$i]);
 269       }
 270     }
 271
 272     // incase of ajax functions className is passed in url
 273     if (isset($params['className'])) {
 274       $params['className'] = CRM_Utils_String::munge($params['className']);
 275
 276       // functions that are defined only in AJAX.php can be called via
 277       // rest interface
 278       if (!CRM_Core_Page_AJAX::checkAuthz('method', $params['className'], $params['fnName'])) {
 279         return self::error('Unknown function invocation.');
 280       }
 281
 282       return call_user_func([$params['className'], $params['fnName']], $params);
 283     }
 284
 285     if (!array_key_exists('version', $params)) {
 286       $params['version'] = 3;
 287     }
 288
 289     if ($params['version'] == 2) {
 290       $result['is_error'] = 1;
 291       $result['error_message'] = "FATAL: API v2 not accessible from ajax/REST";
 292       $result['deprecated'] = "Please upgrade to API v3";
 293       return $result;
 294     }
 295
 296     if ($_SERVER['REQUEST_METHOD'] == 'GET' &&
 297       strtolower(substr($args[2], 0, 3)) != 'get' &&
 298       strtolower($args[2] != 'check')) {
 299       // get only valid for non destructive methods
 300       require_once 'api/v3/utils.php';
 301       return civicrm_api3_create_error("SECURITY: All requests that modify the database must be http POST, not GET.",
 302         [
 303           'IP' => $_SERVER['REMOTE_ADDR'],
 304           'level' => 'security',
 305           'referer' => $_SERVER['HTTP_REFERER'],
 306           'reason' => 'Destructive HTTP GET',
 307         ]
 308       );
 309     }
 310
 311     // trap all fatal errors
 312     $errorScope = CRM_Core_TemporaryErrorScope::create([
 313       'CRM_Utils_REST',
 314       'fatal',
 315     ]);
 316     $result = civicrm_api($args[1], $args[2], $params);
 317     unset($errorScope);
 318
 319     if ($result === FALSE) {
 320       return self::error('Unknown error.');
 321     }
 322     return $result;
 323   }
 324
 325   /**
 326    * @return array|mixed|null
 327    */
 328   public static function &buildParamList() {
 329     $requestParams = CRM_Utils_Request::exportValues();
 330     $params = [];
 331
 332     $skipVars = [
 333       'q' => 1,
 334       'json' => 1,
 335       'key' => 1,
 336       'api_key' => 1,
 337       'entity' => 1,
 338       'action' => 1,
 339     ];
 340
 341     if (array_key_exists('json', $requestParams) && $requestParams['json'][0] == "{") {
 342       $params = json_decode($requestParams['json'], TRUE);
 343       if ($params === NULL) {
 344         CRM_Utils_JSON::output([
 345           'is_error' => 1,
 346           0 => 'error_message',
 347           1 => 'Unable to decode supplied JSON.',
 348         ]);
 349       }
 350     }
 351     foreach ($requestParams as $n => $v) {
 352       if (!array_key_exists($n, $skipVars)) {
 353         $params[$n] = $v;
 354       }
 355     }
 356     if (array_key_exists('return', $requestParams) && is_array($requestParams['return'])) {
 357       foreach ($requestParams['return'] as $key => $v) {
 358         $params['return.' . $key] = 1;
 359       }
 360     }
 361     return $params;
 362   }
 363
 364   /**
 365    * @param $pearError
 366    */
 367   public static function fatal($pearError) {
 368     CRM_Utils_System::setHttpHeader('Content-Type', 'text/xml');
 369     $error = [];
 370     $error['code'] = $pearError->getCode();
 371     $error['error_message'] = $pearError->getMessage();
 372     $error['mode'] = $pearError->getMode();
 373     $error['debug_info'] = $pearError->getDebugInfo();
 374     $error['type'] = $pearError->getType();
 375     $error['user_info'] = $pearError->getUserInfo();
 376     $error['to_string'] = $pearError->toString();
 377     $error['is_error'] = 1;
 378
 379     echo self::output($error);
 380
 381     CRM_Utils_System::civiExit();
 382   }
 383
 384   /**
 385    * used to load a template "inline", eg. for ajax, without having to build a menu for each template
 386    */
 387   public static function loadTemplate() {
 388     $request = CRM_Utils_Request::retrieve('q', 'String');
 389     if (FALSE !== strpos($request, '..')) {
 390       die("SECURITY FATAL: the url can't contain '..'. Please report the issue on the forum at civicrm.org");
 391     }
 392
 393     $request = explode('/', $request);
 394     $entity = _civicrm_api_get_camel_name($request[2]);
 395     $tplfile = _civicrm_api_get_camel_name($request[3]);
 396
 397     $tpl = 'CRM/' . $entity . '/Page/Inline/' . $tplfile . '.tpl';
 398     $smarty = CRM_Core_Smarty::singleton();
 399     CRM_Utils_System::setTitle("$entity::$tplfile inline $tpl");
 400     if (!$smarty->template_exists($tpl)) {
 401       CRM_Utils_System::setHttpHeader("Status", "404 Not Found");
 402       die("Can't find the requested template file templates/$tpl");
 403     }
 404     // special treatmenent, because it's often used
 405     if (array_key_exists('id', $_GET)) {
 406       // an id is always positive
 407       $smarty->assign('id', (int) $_GET['id']);
 408     }
 409     $pos = strpos(implode(array_keys($_GET)), '<');
 410
 411     if ($pos !== FALSE) {
 412       die("SECURITY FATAL: one of the param names contains &lt;");
 413     }
 414     $param = array_map('htmlentities', $_GET);
 415     unset($param['q']);
 416     $smarty->assign_by_ref("request", $param);
 417
 418     if (!array_key_exists('HTTP_X_REQUESTED_WITH', $_SERVER) ||
 419       $_SERVER['HTTP_X_REQUESTED_WITH'] != "XMLHttpRequest"
 420     ) {
 421
 422       $smarty->assign('tplFile', $tpl);
 423       $config = CRM_Core_Config::singleton();
 424       $content = $smarty->fetch('CRM/common/' . strtolower($config->userFramework) . '.tpl');
 425
 426       if (!defined('CIVICRM_UF_HEAD') && $region = CRM_Core_Region::instance('html-header', FALSE)) {
 427         CRM_Utils_System::addHTMLHead($region->render(''));
 428       }
 429       CRM_Utils_System::appendTPLFile($tpl, $content);
 430
 431       return CRM_Utils_System::theme($content);
 432
 433     }
 434     else {
 435       $content = "<!-- .tpl file embedded: $tpl -->\n";
 436       CRM_Utils_System::appendTPLFile($tpl, $content);
 437       echo $content . $smarty->fetch($tpl);
 438       CRM_Utils_System::civiExit();
 439     }
 440   }
 441
 442   /**
 443    * This is a wrapper so you can call an api via json (it returns json too)
 444    * http://example.org/civicrm/api/json?entity=Contact&action=Get"&json={"contact_type":"Individual","email.get.email":{}}
 445    * to take all the emails from individuals.
 446    * Works for POST & GET (POST recommended).
 447    */
 448   public static function ajaxJson() {
 449     $requestParams = CRM_Utils_Request::exportValues();
 450
 451     require_once 'api/v3/utils.php';
 452     $config = CRM_Core_Config::singleton();
 453     if (!$config->debug && (!array_key_exists('HTTP_X_REQUESTED_WITH', $_SERVER) ||
 454         $_SERVER['HTTP_X_REQUESTED_WITH'] != "XMLHttpRequest"
 455       )
 456     ) {
 457       $error = civicrm_api3_create_error("SECURITY ALERT: Ajax requests can only be issued by javascript clients, eg. CRM.api3().",
 458         [
 459           'IP' => $_SERVER['REMOTE_ADDR'],
 460           'level' => 'security',
 461           'referer' => $_SERVER['HTTP_REFERER'],
 462           'reason' => 'CSRF suspected',
 463         ]
 464       );
 465       CRM_Utils_JSON::output($error);
 466     }
 467     if (empty($requestParams['entity'])) {
 468       CRM_Utils_JSON::output(civicrm_api3_create_error('missing entity param'));
 469     }
 470     if (empty($requestParams['entity'])) {
 471       CRM_Utils_JSON::output(civicrm_api3_create_error('missing entity entity'));
 472     }
 473     if (!empty($requestParams['json'])) {
 474       $params = json_decode($requestParams['json'], TRUE);
 475     }
 476     $entity = CRM_Utils_String::munge(CRM_Utils_Array::value('entity', $requestParams));
 477     $action = CRM_Utils_String::munge(CRM_Utils_Array::value('action', $requestParams));
 478     if (!is_array($params)) {
 479       CRM_Utils_JSON::output([
 480         'is_error' => 1,
 481         'error_message' => 'invalid json format: ?{"param_with_double_quote":"value"}',
 482       ]);
 483     }
 484
 485     $params['check_permissions'] = TRUE;
 486     $params['version'] = 3;
 487     // $requestParams is local-only; this line seems pointless unless there's a side-effect influencing other functions
 488     $_GET['json'] = $requestParams['json'] = 1;
 489     if (!$params['sequential']) {
 490       $params['sequential'] = 1;
 491     }
 492
 493     // trap all fatal errors
 494     $errorScope = CRM_Core_TemporaryErrorScope::create([
 495       'CRM_Utils_REST',
 496       'fatal',
 497     ]);
 498     $result = civicrm_api($entity, $action, $params);
 499     unset($errorScope);
 500
 501     echo self::output($result);
 502
 503     CRM_Utils_System::civiExit();
 504   }
 505
 506   /**
 507    * Run ajax request.
 508    *
 509    * @return array
 510    */
 511   public static function ajax() {
 512     $requestParams = CRM_Utils_Request::exportValues();
 513
 514     // this is driven by the menu system, so we can use permissioning to
 515     // restrict calls to this etc
 516     // the request has to be sent by an ajax call. First line of protection against csrf
 517     $config = CRM_Core_Config::singleton();
 518     if (!$config->debug &&
 519       (!array_key_exists('HTTP_X_REQUESTED_WITH', $_SERVER) ||
 520         $_SERVER['HTTP_X_REQUESTED_WITH'] != "XMLHttpRequest"
 521       )
 522     ) {
 523       require_once 'api/v3/utils.php';
 524       $error = civicrm_api3_create_error("SECURITY ALERT: Ajax requests can only be issued by javascript clients, eg. CRM.api3().",
 525         [
 526           'IP' => $_SERVER['REMOTE_ADDR'],
 527           'level' => 'security',
 528           'referer' => $_SERVER['HTTP_REFERER'],
 529           'reason' => 'CSRF suspected',
 530         ]
 531       );
 532       CRM_Utils_JSON::output($error);
 533     }
 534
 535     $q = CRM_Utils_Array::value('fnName', $requestParams);
 536     if (!$q) {
 537       $entity = CRM_Utils_Array::value('entity', $requestParams);
 538       $action = CRM_Utils_Array::value('action', $requestParams);
 539       if (!$entity || !$action) {
 540         $err = [
 541           'error_message' => 'missing mandatory params "entity=" or "action="',
 542           'is_error' => 1,
 543         ];
 544         echo self::output($err);
 545         CRM_Utils_System::civiExit();
 546       }
 547       $args = ['civicrm', $entity, $action];
 548     }
 549     else {
 550       $args = explode('/', $q);
 551     }
 552
 553     // get the class name, since all ajax functions pass className
 554     $className = CRM_Utils_Array::value('className', $requestParams);
 555
 556     // If the function isn't in the civicrm namespace, reject the request.
 557     if (($args[0] != 'civicrm' && count($args) != 3) && !$className) {
 558       return self::error('Unknown function invocation.');
 559     }
 560
 561     // Support for multiple api calls
 562     if (isset($entity) && $entity === 'api3') {
 563       $result = self::processMultiple();
 564     }
 565     else {
 566       $result = self::process($args, self::buildParamList());
 567     }
 568
 569     echo self::output($result);
 570
 571     CRM_Utils_System::civiExit();
 572   }
 573
 574   /**
 575    * Callback for multiple ajax api calls from CRM.api3()
 576    * @return array
 577    */
 578   public static function processMultiple() {
 579     $output = [];
 580     foreach (json_decode($_REQUEST['json'], TRUE) as $key => $call) {
 581       $args = [
 582         'civicrm',
 583         $call[0],
 584         $call[1],
 585       ];
 586       $output[$key] = self::process($args, CRM_Utils_Array::value(2, $call, []));
 587     }
 588     return $output;
 589   }
 590
 591   /**
 592    * @return array|NULL
 593    *   NULL if execution should proceed; array if the response is already known
 594    */
 595   public function loadCMSBootstrap() {
 596     $requestParams = CRM_Utils_Request::exportValues();
 597     $q = CRM_Utils_Array::value('q', $requestParams);
 598     $args = explode('/', $q);
 599
 600     // Proceed with bootstrap for "?entity=X&action=Y"
 601     // Proceed with bootstrap for "?q=civicrm/X/Y" but not "?q=civicrm/ping"
 602     if (!empty($q)) {
 603       if (count($args) == 2 && $args[1] == 'ping') {
 604         CRM_Utils_System::loadBootStrap([], FALSE, FALSE);
 605         // this is pretty wonky but maybe there's some reason I can't see
 606         return NULL;
 607       }
 608       if (count($args) != 3) {
 609         return self::error('ERROR: Malformed REST path');
 610       }
 611       if ($args[0] != 'civicrm') {
 612         return self::error('ERROR: Malformed REST path');
 613       }
 614       // Therefore we have reasonably well-formed "?q=civicrm/X/Y"
 615     }
 616
 617     if (!CRM_Utils_System::authenticateKey(FALSE)) {
 618       // FIXME: At time of writing, this doesn't actually do anything because
 619       // authenticateKey abends, but that's a bad behavior which sends a
 620       // malformed response.
 621       CRM_Utils_System::loadBootStrap([], FALSE, FALSE);
 622       return self::error('Failed to authenticate key');
 623     }
 624
 625     $uid = NULL;
 626     if (!$uid) {
 627       $store = NULL;
 628       $api_key = CRM_Utils_Request::retrieve('api_key', 'String', $store, FALSE, NULL, 'REQUEST');
 629       if (empty($api_key)) {
 630         CRM_Utils_System::loadBootStrap([], FALSE, FALSE);
 631         return self::error("FATAL: mandatory param 'api_key' (user key) missing");
 632       }
 633       $contact_id = CRM_Core_DAO::getFieldValue('CRM_Contact_DAO_Contact', $api_key, 'id', 'api_key');
 634       if ($contact_id) {
 635         $uid = CRM_Core_BAO_UFMatch::getUFId($contact_id);
 636       }
 637     }
 638
 639     if ($uid && $contact_id) {
 640       CRM_Utils_System::loadBootStrap(['uid' => $uid], TRUE, FALSE);
 641       $session = CRM_Core_Session::singleton();
 642       $session->set('ufID', $uid);
 643       $session->set('userID', $contact_id);
 644       CRM_Core_DAO::executeQuery('SET @civicrm_user_id = %1',
 645         [1 => [$contact_id, 'Integer']]
 646       );
 647       return NULL;
 648     }
 649     else {
 650       CRM_Utils_System::loadBootStrap([], FALSE, FALSE);
 651       return self::error('ERROR: No CMS user associated with given api-key');
 652     }
 653   }
 654
 655 }